WO2012100531A1

WO2012100531A1 - Method, apparatus and system for forwarding packet

Info

Publication number: WO2012100531A1
Application number: PCT/CN2011/078924
Authority: WO
Inventors: 黄静; 查敏
Original assignee: 华为技术有限公司
Priority date: 2011-01-26
Filing date: 2011-08-25
Publication date: 2012-08-02
Also published as: CN102624935A

Abstract

Disclosed are a method, an apparatus and a system for forwarding a packet. A network address translation device receives an Internet Protocol (IP) packet from a user terminal; network address translation is performed on the IP packet; information for identifying a user is inserted in the IP packet; the IP packet in which the information for identifying a user is inserted is sent, so that a network device receiving the IP packet distinguishes the user terminal according to the information for identifying a user. By use of the technical solutions provided in the embodiments of the present invention, solved may be a problem in the prior art that a user is distinguished and traced to the source by querying a log file so the network complexity and the load of a log server are high.

Description

Method, device and system for forwarding messages, the application is submitted to the Chinese Patent Office on January 26, 2011, and the application number is 201110028650. 3. The invention name is "a method, device and system for forwarding messages" Priority of Chinese Patent Application, the entire contents of which is incorporated herein by reference. The present invention relates to the field of network communications, and in particular, to a method, device and system for forwarding a message. BACKGROUND In the transition of IPv4 (Internet Protocol version 4, Internet Protocol version 4) address, IPv4 to IPv6 (Internet Protocol version 6, 6th edition Internet Protocol), since IPv6 has not been applied on a large scale, in a short time The address shortage problem cannot be solved. To solve the address shortage problem, the carrier needs to deploy a CGN (Carrier Grade NAT) device to reuse the public network IPv4 address (hereinafter referred to as the IP address). However, after the CGN is deployed, many users share a public IP address after NAT (Network Address Translation). According to the public IP address, specific users cannot be found, which causes problems for some applications. For example, some national regulations require operators to support user traceability to combat cybercrime; some need to distinguish user applications based on IP addresses, such as user behavior analysis, application server to limit the number of concurrent download threads of users according to IP address, or according to IP address. To ban some users who keep sending articles. In this way, the user needs to be correctly distinguished by user identification and user traceability.

On the existing CGN network, the CGN generates a log file, which records the correspondence between the intranet information (such as the private IP address/port) and the external network information (such as the public IP address/port), and the time. Stamp, protocol type, etc.; log files can be stored locally or on a dedicated log server. Then, the user can query the log file to obtain further information of the user, such as the private network IP address, by using the information such as the IP address and the port number of the user's public network, thereby identifying the user, and then, according to the private network IP address and the like, to the AAA (Authentication Authorization Accounting) , authentication and authorization charging) The server queries and obtains the user's detailed information. In the case of multi-level CGN, each level of CGN log files needs to be queried in order to finally obtain user information, and the network is more complicated. On the other hand, for the sake of confidentiality and security of user information, the log files of the operators are generally only open to the internal operators or law enforcement agencies of the operators, and are not open to other operators or websites. For example, downloading websites cannot access the logs of operators. The file gets the user information, so the user cannot be distinguished. Summary of the invention

The embodiment of the invention provides a method, a device and a system for forwarding a message, so as to solve the problem of user identification and traceability, network complexity and high log server load by accessing the CGN log server in the prior art.

To solve the above technical problem, the embodiment of the present invention provides a method for forwarding a packet, including: receiving, by a network address translation device, an Internet Protocol IP packet from a user terminal;

Performing network address translation on the IP packet;

Inserting information identifying the user in the converted IP packet;

Sending the IP packet in which the information of the identified user is inserted, so that the network device that receives the IP packet identifies the user terminal according to the information of the identified user.

An embodiment of the present invention provides an apparatus for forwarding a message, including:

a receiver, configured to receive, by the network address translation device, an internet protocol IP packet from the user terminal, and a conversion module, configured to perform network address translation on the IP packet;

An insertion module, configured to insert information identifying the user in the converted IP packet;

And a transmitter, configured to send the IP packet in which the information of the identified user is inserted, so that the network device that receives the IP packet identifies the user terminal according to the information of the identified user.

The embodiment of the invention provides a system for forwarding a message, which is characterized in that it comprises:

a network address translation device, configured to receive an IP packet from the user terminal, perform network address translation on the IP packet, insert information identifying the user in the converted IP packet, and send the identifier into the identifier IP packet of the user's information;

And a receiving device, configured to receive the IP packet in which the information of the identified user is inserted, and identify the user terminal according to the information of the identifier user.

Embodiments of the invention have the following advantages:

In the embodiment of the present invention, the network address translation device carries the information identifying the user in the user IP packet, and the receiving device, for example, a website/the forum server, can perform the user according to the information of the user identified in the received IP packet. Identification and traceability. It can be seen that, because the IP packet carries the information identifying the user, the user can be identified in real time according to the information of the identified user without increasing the network complexity and the load of the log server, and then the user can be obtained. Detailed information to achieve user traceability. BRIEF DESCRIPTION OF THE DRAWINGS In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following will The drawings used in the description of the prior art are briefly introduced. It is obvious that the drawings in the following description are only some embodiments of the present invention, and are not laborious for those skilled in the art. Further drawings can also be obtained from these drawings.

FIG. 1 is a flowchart of a method for forwarding a message according to an embodiment of the present invention;

2 is a block diagram of an apparatus for forwarding a message according to an embodiment of the present invention;

FIG. 3 is a block diagram of a system for forwarding a message according to an embodiment of the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. The described embodiments are only a part of the embodiments of the invention, and not all of the embodiments. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

The embodiment of the present invention provides a method for forwarding a message, including: receiving, by a network address translation device, an Internet Protocol IP packet from a user terminal, inserting information identifying the user in the IP packet; and sending the insertion to the network The IP packet that identifies the information of the user, so that the network device that receives the IP packet identifies the user terminal according to the information of the identified user. The technical solution provided by the embodiment of the present invention can solve the problem of user identification and traceability, network complexity, and high load of the log server by accessing the CGN log server in the prior art.

The above described objects, features and advantages of the embodiments of the present invention will become more apparent and understood.

FIG. 1 is a flowchart of a method for forwarding a packet according to an embodiment of the present invention. The specific steps are as follows: Step 101: A network address translation device receives an Internet Protocol IP packet from a user terminal.

The network address translation device can be a CGN device.

Step 102: Perform network address translation on the IP packet.

Step 103: Insert information identifying the user in the converted IP packet.

The information identifying the user is an identifier of a user who can identify a CGN, and is usually an IPv4 address of the user terminal.

However, in some scenarios, user terminals connected to the same CGN may have the same IPv4 address. Other information is required. For example, the tunnel identifier of the user terminal to the CGN device includes an IPv6 address, a virtual private network VPN identifier, and a universal routing encapsulation. GRE keyword, PPTP tunnel identifier, L2TP tunnel identifier, IPSec tunnel label Knowledge or IPv6 flow labe l (IPv6 flow label) to distinguish users. For example, in the DS-Lite solution, multiple home gateways access one CGN, and one home gateway has multiple users, and all home gateways use 192. 0. 0. 0/29 network segment except 192. 0. The addresses outside 0. 0 and 192. 0. 0. 1 assign IPv4 addresses to users. In this way, the IPv4 addresses of many users in a CGN are the same; if the user directly establishes a tunnel with the CGN, for example, IPv4-in- An IPv6 tunnel. In this case, the user can be identified by identifying the IPv6 address through the tunnel. If the user establishes a tunnel with the CGN through the home gateway, the user needs to identify the CGN with the user's IPv4 address and tunnel identifier.

In addition, in some scenarios, users need to go through multiple CGN devices to access a website. One way is that each level of CGN devices performs NAT translation on the user's IP packets and converts the translated IP packets. Insert the information identifying the user (the IP address before the NAT). When the website receives the final IP packet after the NAT conversion of the multi-level CGN device, the source IP address of the final IP packet and the source IP address are required. The information of the user is identified to identify the user. In another mode, each level of the CGN device performs NAT translation on the user's IP packet, but only the first-level CGN device inserts the identifier into the converted IP packet. The user's information (the user's IP address and the identifier of the first-level CGN device, such as the public network IPv4 address or domain name that can uniquely identify the CGN device, etc.), when the website receives the final IP packet, according to the final The user who identifies the user carried in the IP packet can identify the user.

Step 104: Send the IP packet in which the information of the identified user is inserted, so that the network device that receives the IP packet identifies the user terminal according to the information of the identified user. Example 1

The IP address of the user terminal passes through the primary CGN device, and the IPv4 address of the user terminal can identify the scene of the user as an example. A CGN device has two users Userl (IPv4 address ip l) and User2 (IPv4 address ip2) accessing a certain website of the Internet under CGN1. According to an embodiment of the present invention, the process is as follows:

CGN1 receives IP packets from Userl and User2, and the source IP addresses are ip l and ip2 respectively.

CGN1 performs NAT translation on the IP packet. The source IP address of the translated IP packet is an IPv4 address of CGN1.

CGN1 inserts the information ipl identifying User1 in the IP packet from User1, and inserts the information ip2 identifying User2 in the IP packet from User2;

The CGN1 re-encapsulates and transmits the IP packets from the Userl and User2 that are NAT-converted and inserted with the information identifying the user. When the website receives the IP packet from the CGN1, the information of the user that is carried in the packet is Ipl and ip2, you can distinguish between Userl and User2. When needed, the site can identify Userl and take it as needed Take measures, such as restricting or prohibiting User 1 from accessing the website, or querying the user information server (for example, AAA server) according to the information ip 1 of the identification User 1, obtaining the detailed information of User1, and realizing the user traceability. Example 2

The IP address of the user terminal passes through the first-level CGN. The IPv4 address of the user terminal cannot uniquely identify the scenario of a user in the CGN as an example. For example, a CGN device CGN1 has multiple home gateways CPE1, CPE2, etc., and there are multiple user terminals under one home gateway. For example, there are Userl (IPv4 address is ipl) and User2 (IPv4 address is ip2) under CPE1, under CPE2. There are User5 (IPv4 address is ipl), User6 (IPv4 address is ip3), and so on. Assume that CPE1 and CPE2 do not perform NAT translation. An IPv6 tunnel is established between CPE1 and CGN1. The tunnel ID is IPv6_l. The IP6 packet is encapsulated by the IPv6 tunnel. The IPv6 tunnel is set up between CPE2 and CGN1. The tunnel ID is IPv6_2 and encapsulated by IPv6 tunnel. IP packet of the user terminal. The users Userl, User2 and User5 access a certain website of the Internet, according to an embodiment of the present invention, the process is as follows:

CGN1 receives IPv6 tunnel packets from CPE1 and CPE2, and decapsulates the IPv6 tunnel packets. After decapsulation, the source IP addresses of IP packets from Userl, User2, and User5 are ipl, ip2, and ipl.

CGN1 performs NAT translation on the IP packet. After the conversion, the source IP address of the IP packets from User1, User2, and User5 is an IPv4 address of CGN1.

CGN1 inserts the information IPv6-l and ipl that identifies User1 in the IP packet from User1, inserts the information IPv6-l and ip2 that identifies User2 in the IP packet from User2, and inserts the identifier User5 in the IP packet from User5. Information for IPv6-2 and ipl;

CGN1 repackages IP packets from Userl, User2, and User5, and sends information that identifies the user.

IP packet; After receiving the IP packet from CGN1, the website can distinguish Userl according to the information of the user carried in the packet, namely IPv6-l and ipl, IPv6-l and ip2, IPv6_2 and ipl. User2 and User5. If necessary, you can query the user information server (for example, AAA server) based on the information identifying Userl, User2, and User5, and obtain detailed information of Userl, User2, and User5 to implement user traceability. Example 3

The IP address of the user terminal passes through the multi-level CGN device, and the IPv4 address of the user terminal can identify a user under the CGN. The CGNs at each level insert the information identifying the user into the IP packet as an example. For example, the user Userl (the IPv4 address is ipl) accesses a certain website of the Internet, and the IP packet of the user terminal passes through two levels of CGN devices, which are CGN1 and CGN2 in sequence. According to an embodiment of the present invention, the process is as follows: The CGN1 receives the IP packet from the user1, and the source IP address of the IP packet is ip1. The CGN1 performs NAT translation on the IP packet, converts the source IP address into ip2, and inserts ipl into the IP packet. Then, the IP packet is re-encapsulated, and the source IP address is ip2, and the IP packet carrying the IP address is sent. The CGN2 receives the IP packet from the CGN1, performs NAT translation on the IP packet, and uses the source IP address. The address is converted to ip3, and the ip2 is inserted into the IP packet, and then the IP packet is re-encapsulated, and the IP packet whose source IP address is ip3 and carries the information ipl and ip2 of the userl is sent; The website receives the IP packet, and identifies Userl according to the source IP address ip3 of the IP packet, and identifies the information ipl and ip2 of Userl. If necessary, the user information server (for example, the AAA server) is queried according to the information of the user1, and the detailed information of the user1 is obtained, so that the user can trace the source. Example 4

The IP address of the user terminal passes through the multi-level CGN device, and the IPv4 address of the user terminal can identify a user under the CGN. Only the first-level CGN inserts information identifying the user (including the IPv4 address of the user terminal) in the IP packet. As an example, the identification of the first-level CGN device. For example, under the CGN1 (identified as IPnl) user Userl (IPv4 address is ipO) and CGN2 (identified as IPn2), user User2 (IPv4 address is ipO) accesses a website on the Internet, and Userl's IP packet passes through the secondary CGN device. In this order, CGN1 and CGN3, the IP packet of User2 is to pass through the secondary CGN device, which in turn is CGN2 and CGN3. According to an embodiment of the present invention, the process is as follows:

The CGN1 receives the IP packet from the user1, and the source IP address of the IP packet is ip0. The CGN1 performs NAT translation on the IP packet, converts the source IP address into ipl, and inserts an identifier into the IP packet. Userl's information ipO and IPnl, and then re-encapsulating the IP packet, and sending the IP packet whose source IP address is ipl, carrying ipO and IPnl; CGN2 receiving the IP packet from User2, the IP packet The source IP address is ip0, and CGN2 performs NAT translation on the IP packet, converts the source IP address to ip2, and inserts information ipO and IPn2 identifying User2 in the IP packet, and then re-encapsulates the IP packet. And sending the IP packet whose source IP address is ip2 and carrying ipO and IPn2; CGN3 receives the IP packet from CGN1 and CGN2, and performs NAT translation on the IP packet from CGN1, and the source IP address after conversion is Ip3, NAT translation of the IP packet from CGN2, the source IP address is also ip3 after the conversion _; CGN3 re-encapsulates and sends the converted IP packet; Finally, the website receives the IP packet from CGN3, according to the The information of the identified user of the IP packet is ipO and IPnl, and ipO and IPn2 are available. Identifying Userl and User2. If necessary, the user information server (for example, the AAA server) is queried according to the information of the identified user, and the user detailed information is obtained, so that the user can trace the source. Referring to FIG. 2, it is a block diagram of a device for forwarding a message according to an embodiment of the present invention. The device specifically includes a receiver 201, a conversion module 202, an insertion module 203, and a transmitter 204. among them: The receiver 201 is configured to: the network address translation device receives an IP packet from the user terminal; and the network address translation device may be a CGN device.

The converting module 202 is configured to perform network address translation on the IP packet.

The inserting module 203 is configured to identify the information of the user in the converted IP packet.

The information identifying the user is an identifier of a user who can identify a CGN, usually a user terminal.

IPv4 address; However, in some scenarios, user terminals connected to the same CGN may have the same IPv4 address. In this case, other information, such as the tunnel identifier IPv6 address of the user terminal to the CGN, and the virtual private network VPN identifier, The general route encapsulation GRE keyword, PPTP tunnel identifier, L2TP tunnel identifier, IPSec tunnel identifier, or IPv6 f low labe l (IPv6 flow label) to distinguish users; in some scenarios, users need to access multiple CGN devices to access a website; if each level of the CGN device inserts the information identifying the user in the IP packet after the NAT is translated, the user needs to be identified according to the source IP address of the final IP packet and the information identifying the user therein; The first-level CGN device inserts information identifying the user (the IP address of the user and the identifier of the first-level CGN device) in the NAT-transformed IP packet, and only needs to identify the user information carried in the final IP packet. It is possible to identify the user.

a transmitter 204, configured to send the IP packet in which the information of the identified user is inserted, so that the

The network device of the IP packet identifies the user terminal according to the information identifying the user. Example 5

The receiver 201 receives IP packets from User1 and User2, and the source IP addresses are ipl and ip2 _, respectively _;

The conversion module 202 performs NAT conversion on the IP packet, and the source IP address of the converted IP packet is an IPv4 address of the CGN1;

The inserting module 203 inserts the information ipl identifying the User1 in the IP packet from the User1, and inserts the information ip2 identifying the User2 in the IP packet from the User2 _;

The CGN1 re-encapsulates the IP packets from the Userl and User2 that have been NAT-transformed and inserted the information identifying the user, and then the sender 204 sends the IP packet. When the website receives the IP packet from the CGN1, the packet is received according to the packet. The information of the identified users carried in the user is ipl and ip2, respectively, and Userl and User2 can be distinguished. If necessary, query the user information server (for example, AAA server) according to the information ipl of the identification Userl, and obtain the detailed information of Userl. User traceability. Example 6

The IP address of the user terminal passes through the first-level CGN. The IPv4 address of the user terminal cannot uniquely identify the scenario of a user in the CGN as an example. For example, a CGN device CGN1 has multiple home gateways CPE1, CPE2, etc., and there are multiple user terminals under one home gateway. For example, there are Userl (IPv4 address is ipl) and User2 (IPv4 address is ip2) under CPE1, under CPE2. User5 (IPv4 address is ipl), User6 (IPv4 address is ip3), etc.; assuming that CPE1 and CPE2 do not perform NAT translation, an IPv6 tunnel is established between CPE1 and CGN1, and the tunnel identifier is IPv6_1. The IP packet of the user terminal is encapsulated by the IPv6 tunnel. An IPv6 tunnel is established between CPE2 and CGN1. The tunnel ID is IPv6_2, and the IP packets of the user terminal are encapsulated by the IPv6 tunnel. Users Userl, User2 and User5 access a certain website of the Internet, according to an embodiment of the present invention, the process is as follows:

Receiver 201 receives the IPv6 tunnel packet from CPE1 and CPE2, and CGN1 decapsulates the IPv6 tunnel packet. After decapsulation, the source IP addresses of IP packets from Userl, User2, and User5 are ipl, ip2, and ipl. ;

The conversion module 202 performs NAT conversion on the IP packet, and the source IP address of the IP packet from User1, User2, and User5 is an IPv4 address of CGN1;

The inserting module 203 inserts the information IPv6-1 and ipl identifying the User1 in the IP packet from the User1, and inserts the information IPv6-1 and ip2 identifying the User2 in the IP packet from the User2, and inserts the IP packet from the User5. Identifies the information of User5, IPv6-2 and ipl;

CGN1 re-encapsulates the IP packets from User1, User2, and User5. The sender 204 sends an IP packet with the information identifying the user. When the website receives the IP packet from CGN1, it identifies the user according to the identifier carried in the packet. The information is IPv6-l and ipl, IPv6-l and ip2, IPv6_2 and ipl, which can distinguish Userl, User2 and User5. If necessary, you can query the user information server (for example, AAA server) based on the information identifying Userl, User2, and User5 to obtain detailed information of Userl, User2, and User5, which can be used to trace the source. Example 7

The IP address of the user terminal passes through the multi-level CGN device, and the IPv4 address of the user terminal can identify a user under the CGN. The CGNs at each level insert the information identifying the user into the IP packet as an example. For example, the user Userl (the IPv4 address is ipl) accesses a certain website of the Internet, and the IP packet of the user terminal passes through two levels of CGN devices, which are CGN1 and CGN2 in sequence. According to an embodiment of the present invention, the process is as follows: The receiver 201 of the CGN1 receives the IP packet from the user1, and the source IP address of the IP packet is ipl. The conversion module 202 of the CGN1 performs NAT translation on the IP packet, and converts the source IP address into ip2, CGN1. The inserting module 203 inserts ipl into the IP packet, and then the CGN1 re-encapsulates the IP packet, and the transmitter 204 of the CGN1 sends the IP packet whose source IP address is ip2 and carries the IP1; the receiver 201 of the CGN2 Receiving the IP packet from the CGN1, the conversion module 202 of the CGN2 performs NAT translation on the IP packet, and converts the source IP address into ip3. The insertion module 203 of the CGN1 inserts ip2 into the IP packet, and then CGN2 Re-encapsulating the IP packet, the sender 204 of the CGN2 sends the IP packet whose source IP address is ip3, carrying ip1 and ip2; finally, the website receives the IP packet from CGN2, according to the The source IP address ip3 of the IP packet, which identifies the information ipl and ip2 of Userl, can identify Userl. If necessary, the user information server (for example, the AAA server) is queried according to the information of the user1, and the detailed information of the user1 is obtained, so that the user can trace the source. Example 8

The IP address of the user terminal passes through the multi-level CGN device, and the IPv4 address of the user terminal can identify a user under the CGN. Only the first-level CGN device inserts information identifying the user in the IP packet (including the IPv4 of the user terminal). Take the address and the identifier of the first-level CGN device as an example. For example, under CGN1 (identified as IPnl), User Userl (IPv4 address is ipO) and CGN2 (identified as IPn2), User User2 (IPv4 address is ipO) accesses a website on the Internet, and Userl's IP packet passes through the secondary CGN device. In this order, CGN1 and CGN3, the IP packet of User2 is to pass through the secondary CGN device, which in turn is CGN2 and CGN3. According to an embodiment of the present invention, the process is as follows:

The receiver 201 of the CGN1 receives the IP packet from the user1, and the source IP address of the IP packet is ip0. The conversion module 202 of the CGN1 performs NAT translation on the IP packet, and converts the source IP address into ipl, CGN1. The inserting module 203 inserts the information ipO and IPn1 identifying the User1 in the IP packet, and the CGN1 re-encapsulates the IP packet, and the transmitter 204 of the CGN1 sends the IP packet whose source IP address is ipl and carries ipO and IPnl. The receiver 201 of the CGN2 receives the IP packet from the user 2, and the source IP address of the IP packet is ip0. The conversion module 202 of the CGN2 performs NAT translation on the IP packet, and converts the source IP address into ip2. The insertion module 203 of the CGN2 inserts the information ipO and IPn2 identifying the User2 in the IP packet, and the CGN2 re-encapsulates the IP packet, and the transmitter 204 of the CGN2 sends the source IP address as ip2, carrying ipO and IPn2. IP packets; CGN3 receives IP packets from CGN1 and CGN2, performs NAT translation on IP packets from CGN1, and converts the source IP address to ip3, performs NAT translation on IP packets from CGN2, and converts the source IP address. Also ip3 _; CGN3 re-encapsulates and sends the converted IP packet Finally, the website receives the IP packet from CGN3, and according to the information identifying the user in the IP packet, ipO and IPnl, ipO and IPn2 can identify Userl and User2. If necessary, query the user information server (for example, AAA server) according to the information identifying the user. Obtain user details and implement user traceability. FIG. 3 is a system block diagram of a forwarding packet according to an embodiment of the present invention, which includes: a network address translation device 301, configured to receive an IP packet from a user terminal, and perform network address translation on the IP packet. Inserting, in the converted IP packet, information identifying the user, and sending the IP packet in which the information of the identified user is inserted;

The receiving device 302 is configured to receive the IP packet in which the information of the identified user is inserted, and identify the user terminal according to the information of the identifier user. By adopting the technical solution provided by the embodiment of the present invention, the user can trace and source the user in real time by carrying the information identifying the user in the IP packet, and solve the problem of user identification and traceability by querying the log file in the prior art, and the network complexity And the problem of high load on the log server. A person skilled in the art can understand that all or part of the steps of implementing the above embodiments may be completed by a program to instruct related hardware, and the program may be stored in a computer readable storage medium, and the storage medium may be a ROM. /RAM, disk or CD, etc.

The above is only a preferred embodiment of the present invention, but the scope of the present invention is not limited thereto, and any person skilled in the art can easily think of changes or within the technical scope disclosed by the present invention. Alternatives are intended to be covered by the scope of the present invention.

Claims

Rights request

A method for forwarding a message, comprising:

The network address translation device receives an internet protocol IP packet from the user terminal;

Performing network address translation on the IP packet;

Inserting information identifying the user in the converted IP packet;

The method according to claim 1, wherein the information identifying the user comprises an IP address of the user terminal and/or a tunnel identifier of the user terminal to the network address translation device.

The method according to claim 2, wherein the information identifying the user further comprises a device identifier of the network address translation device.

The method according to claim 2 or 3, wherein, when the information identifying the user includes the tunnel identifier of the user terminal to the network address translation device, the tunnel identifier includes an IPv6 address, and is virtual. Private network VPN identity, Generic Routing Encapsulation Protocol GRE keyword, Point-to-Point Tunneling Protocol PPTP Tunneling Identity, Layer 2 Tunneling Protocol L2TP Tunneling Identity, Internet Protocol Security IPSec Tunneling Identity or IPv6 Flow Labeling.

5. A device for forwarding a message, comprising:

The device according to claim 6, wherein the information identifying the user comprises an IP address of the user terminal and/or a tunnel identifier of the user terminal to the network address translation device.

The device according to claim 7, wherein the information identifying the user further comprises a device identifier of the network address translation device.

The device according to claim 7 or 8, wherein when the information identifying the user includes an IP address of the user terminal and/or a tunnel identifier of the user terminal to the network address translation device The tunnel identifier includes an IPv4-in-IPv6 tunnel identifier, a virtual private network VPN tunnel identifier, a universal route encapsulation GRE tunnel identifier, a PPTP tunnel identifier, an L2TP tunnel identifier or an IPsec tunnel identifier, or an IPv6 flow label. A system for forwarding a message, comprising: